Privacy Policy
This is an English translation provided for convenience. If there is any discrepancy between this translation and the Korean version, the Korean version prevails.
남윤형 (the "Operator") operates the workout logging app REPUP (the "Service"). In operating the Service, the Operator complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws, and establishes and discloses this Privacy Policy to process users' personal information safely.
1. Purposes of processing personal information
- Sign-up and account management: identifying your account through your Google or Apple account, keeping you signed in, preventing misuse, and processing account deletion
- Providing the Service: storing workout routines, workout records, body weight, diet and supplement records, and equipment photos, syncing them across devices, and providing statistics and reports
- Shared group features: sharing workout and diet records and routines among members of groups you create or join
- Responding to inquiries and keeping the Service stable: investigating errors, answering inquiries, and responding to security incidents
2. Personal information we process
| Category | Items | How collected |
|---|---|---|
| Sign-up (required) Sign in with Google |
Email address, unique Google account identifier, name (profile display name), profile photo URL | Provided by Google |
| Sign-up (required) Sign in with Apple |
Email address (an Apple-provided relay address if you chose Hide My Email), unique Apple account identifier, name (if provided at first sign-in), whether Hide My Email is used, Apple authorization token for revoking the link (stored encrypted) | Provided by Apple |
| Profile (required) | Name used in the app, gender | Entered by you |
| Workout records (required) | Workout routines and exercises, weight and reps for each set, workout start and end times | Entered by you |
| Health-related records (separate consent) |
Body weight, diet notes with calories, carbohydrates, protein and fat, supplement lists and intake records | Entered by you |
| Exercise photos (if used) | Equipment photos saved to exercises (up to 3 per exercise, including the time saved) | Selected by you from the camera or photo library |
| Inquiries (if used) | Inquiry type and content, app version and device type, date and time written | Entered by you (Contact Us in the app) |
| Shared groups (if used) | Group name, display name shown in the group, date and time joined | Entered by you |
| Automatically generated information | Account identification number, sign-up and modification dates, consent records (version and date), server access logs (IP address, request time and path, app and device information (User-Agent), error logs) | Generated while using the Service |
| Former email accounts | If you previously signed up with email, a one-way encrypted value (hash) of your password | Entered by you (in the past) |
- Step counts from Apple Health (HealthKit): we use read access only, solely to display them in the app and on home screen widgets. They are not sent to our server and are not used for advertising or marketing or provided to third parties.
- Group cover photos
- App settings such as display and character settings, supplement reminder times, and D-day goals
- Workout, step count and body weight information exchanged within your devices to display on the Apple Watch app and home screen widgets
3. Processing of health-related information (sensitive information)
Body weight, diet and supplement intake records may constitute health information under Article 23 of the Personal Information Protection Act, so we process them only after obtaining separate consent, distinct from other personal information. This information is used only for managing your own records and providing statistics. However, if you join a shared group, your diet records are visible to members of that group (see Section 5).
4. Retention period
- Member information and Service usage records are retained until you delete your account and are destroyed without delay after deletion.
- Individual records you delete in the app are also deleted from the server at that time.
- Server access logs are kept in Google Cloud's log storage for 30 days and then deleted automatically.
- Where retention is required by law, information is kept for the period specified by that law.
5. Provision of personal information to third parties
The Operator does not provide your personal information to third parties, except in the following cases.
- Shared groups: when you create a group or join one with an invite code, members of the same group can see the following.
- Your group display name and the date and time you joined
- Workout records (routine name, workout start and end times and total workout time, average rest time, exercises, sets, weight and reps)
- Diet records (notes, calories, carbohydrates, protein and fat)
- Your list of routines and their contents
- Where specifically required by law, or where an investigative agency requests it following procedures prescribed by law
6. Outsourcing of personal information processing
To provide the Service, the Operator outsources personal information processing as follows.
| Processor | Outsourced tasks | Retention period |
|---|---|---|
| Google LLC (Google Cloud Platform, Firebase) |
Server operation (Cloud Run), database storage (Cloud Firestore), photo file storage (Cloud Storage), server log retention (Cloud Logging) | Until account deletion or termination of the outsourcing contract |
Sign in with Google and Sign in with Apple are sign-in methods you choose; authentication information is exchanged between you and that provider during sign-in. Each provider's processing of personal information is governed by its own privacy policy.
7. Transfer of personal information overseas
Member information, workout and health-related records, and exercise photos are stored in the Seoul, Republic of Korea region (Google Cloud asia-northeast3). However, server access logs are kept in Google Cloud Logging's global storage and may be transferred overseas.
| Recipient | Google LLC (contact: Google privacy inquiries) |
|---|---|
| Destination countries | The United States and other countries where Google data centers are located |
| Items transferred | IP address, request time and path, app and device information (User-Agent), error logs |
| Time and method of transfer | Transmitted over the network when you use the Service |
| Purpose of transfer | Server operation, error investigation, and security incident response |
| Retention period | Deleted automatically after 30 days |
If you do not want your information transferred overseas, you may refuse by deleting your account; in that case, you will not be able to use the Service.
8. Procedure and method of destruction
- Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay.
- Information in electronic form is deleted in a way that cannot be recovered. We do not process personal information on paper.
- When you delete your account, we delete your account information, all records and group membership information from the server, revoke the Google account connection permission and the Sign in with Apple link, and also erase records stored on your device. Groups you own are deleted entirely.
9. Rights and obligations of users and legal representatives, and how to exercise them
- You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information, and withdraw your consent.
- Directly in the app: change your name (Settings → Account), edit or delete records, leave groups, delete your account (Settings → Account → Delete account)
- By email: send the email address of your account and your request to yoonhyung9775@gmail.com. We will process it within 10 days after verifying your identity and let you know the result.
- You may also exercise your rights through a legal representative or an authorized person; in that case, we may ask for documents confirming the authorization.
10. Personal information of children under 14
Only people aged 14 or older may sign up for the Service, and we do not collect personal information from children under 14. If we learn that a child under 14 has signed up, we will delete that account and its personal information without delay.
11. Measures to ensure the security of personal information
- Administrative measures: access to personal information is limited to one person, the Operator
- Technical measures: HTTPS encryption of all communication, authentication with server-signed tokens and per-account data access control, AES-256-GCM encrypted storage of Apple authorization tokens, and one-way encrypted (hashed) storage of passwords
- Physical measures: storage in access-controlled Google Cloud data centers
12. Installation, operation and refusal of automatic collection tools
The Service does not use cookies, advertising identifiers (IDFA or advertising ID), behavioral information collection or analytics tools, or advertising SDKs. We do not track you across other companies' apps or websites.
13. Privacy officer
| Privacy officer | 남윤형 (Operator) |
|---|---|
| Contact | yoonhyung9775@gmail.com |
Please send inquiries, complaints or requests for remedies regarding the processing of personal information to the contact above, and we will respond without delay.
14. Remedies for infringement of rights
If you need to report or get advice about an infringement of your personal information, you may contact the following Korean agencies.
- Personal Information Dispute Mediation Committee: 1833-6972 (in Korea, no area code), www.kopico.go.kr
- Personal Information Infringement Report Center: 118 (in Korea, no area code), privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301 (in Korea, no area code), www.spo.go.kr
- Korean National Police Agency: 182 (in Korea, no area code), ecrm.police.go.kr
15. Changes to this Privacy Policy
This Privacy Policy applies from October 2, 2026. If anything is added, deleted or modified, we will announce it through the app and this page starting 7 days before it takes effect (30 days before for changes that significantly affect your rights), and will ask for your consent again where necessary.